News for hackers. Stuff that matters.
Re:Diablo 3 bug report: "Passwords not case-sensitive." by jackalope on Friday May 25, 2012 @07:08AM (#4022970)
No. Usually, when I create a password I'm asked to verify it in the next text field. When I visit the login page and enter the exact same characters, I expect it to work. I shouldn't have to guess at my own password because some clever developer's algorithm decides that I made a mistake.
Re:Diablo 3 bug report: "Passwords not case-sensitive." by xaro on Friday May 25, 2012 @07:48AM (#4023074)
You don't need to guess it, if it's implemented the correct way, the signup and the login process will have the same rules and you won't notice.
Re:Diablo 3 bug report: "Passwords not case-sensitive." by nsxwolf on Friday May 25, 2012 @09:55AM (#4023454)
I'm fairly certain you are both jesting.
Re:Diablo 3 bug report: "Passwords not case-sensitive." by Pechtel on Friday May 25, 2012 @11:06AM (#4023773)
I've implemented this very thing for the same reason--it cuts down on user errors. The real answer to password security is length, not putting odd stuff in the passwords that makes people forget them.

There's nothing you need to guess, the logic is in the password encoder and thus will apply both when you set it and when you use it.

Re:Diablo 3 bug report: "Passwords not case-sensitive." by jackalope on Friday May 25, 2012 @12:29PM (#4024203)
Stripping characters reduces length, so you are making passwords less secure by your own criteria.

As for the scenario I described, I experienced it myself in a system that silently stripped spaces from any position in the verification process, storing a different password than the one I typed in, without any warning. My password wouldn't work in the login and I figured it out by examining the password verification code.

I don't understand why it's controversial to simply accept and store a user's password verbatim. Any other approach risks introducing new security issues, from reduced entropy to password clashes. Misguided policy decisions are famous for weakening encryption schemes, like that of the Enigma machine in WWII.